Rendered at 13:34:55 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
geerlingguy 39 minutes ago [-]
Tons of sites are currently offline to hopefully prevent an attack until they can update PHP; just the things I've run into this morning: OBS, TicketTailor, tons of wikis...
I thought they were down earlier, but apparently they were just pre-announcing being down in about 30 minutes, until they finish patching their servers.
I've seen a number of notifications on X and Bluesky of people taking their sites offline, though. Supposedly Cloudflare is providing all customers a WAF rule that will mitigate the exploits they've been able to see so far (though they mention, this is not full protection—patching is still required).
mkesper 37 minutes ago [-]
That's why (mostly) static sites should be delivered as static HTML.
graemep 21 minutes ago [-]
I just moved my last PHP site, my personal blog, to a static site generator. It looks like my timing was lucky!
The only significant thing lost of comments, but they have been getting more spammy over the years. Its actually better now too in many ways and I fixed various issues during the move.
geerlingguy 4 minutes ago [-]
I'm using Remark42; some downsides but somehow, spam has not been a big issue for me. https://remark42.com
woile 12 minutes ago [-]
I've started using atproto as comments on my static blog:
I know nothing about the Belgian Center for Cybersecurity, but the fact that they are running a platform that has been infamous for its security issues for 25 years, and been considered essentially obsolete for 15 years, immediately makes me not take them seriously.
This is like a Health Ministry recommending leech therapy to its employees.
sam_lowry_ 10 minutes ago [-]
What platform hasn't had security issues?
Anyway.
CCB is overtly a marketing organization, not an IT security one.
IIRC they don't even host their own website, The Chancellery of the Prime Minister does it for them.
Avamander 1 minutes ago [-]
That's reducting things too far. There's a vast difference between different languages and CMSs and how likely it is for critical flaws to occur. PHP has a horrible track record and continues to surprise us negatively.
stingraycharles 37 minutes ago [-]
Which kind of makes sense, I think a lot of Dutch websites have been taken offline. I think it’s due to recent regulations that have been introduced.
I think, given the (supposed) seriousness of this issue, it’s an adequate response. I suspect Cloudflare et al will have rules added to their managed WAFs within a few hours after release as well.
That said: it seems like the core issue is that they can’t release PHP publicly without revealing the exploit, wouldn’t it have made more sense to coordinate in the background with these organizations, and important distros, so that this could have been patched without revealing the exploit?
But they say it's a stopgap and still advise patching. It makes sense, since their tweet also says "are updating mitigations as new vectors show up" so it seems like there are many ways to exploit this, whatever it is.
apexalpha 4 minutes ago [-]
A WAF can block known _exploits_ it doesn't prevent the vulnerability from being abused by a new / other / slightly changed exploit.
meffmadd 14 minutes ago [-]
Yes our university is doing the same right now! They where thinking of putting the whole network behind VPN access to protect the poor sysadmins in the Institutes that have not updated their website in years…
rapnie 23 minutes ago [-]
> Which kind of makes sense, I think a lot of Dutch websites have been taken offline.
Europa.eu and all related subdomains were down very early CEST morning. They run Drupal.
trollbridge 33 minutes ago [-]
I expect that Cloudflare already knows some details of the problem and will have the rules up within minutes or seconds.
martijnvds 36 minutes ago [-]
All it takes is one small leak. Which seems to be what happened here.
stingraycharles 20 minutes ago [-]
Ah, so you’re saying that proper orchestration was happening, it’s just that someone leaked it?
> Today, a remote code execution vulnerability was found in PHP, called php2shell.
[...] Since explain xkcd is affected by this exploit, I have decided to take the wiki down until tomorrow.
freecodeio 21 minutes ago [-]
my thoughts and prayers to the stubborn php 4-6 developers who refused to upgrade since 7 and now they have breaking changes with the new 9.2
bombcar 3 minutes ago [-]
Probably easier to back port the patch to 4-6 code than upgrade to 9.2.
Once it's out it's likely to be an easy "disable this damnable feature nobody needs" as usual.
jjice 19 minutes ago [-]
I fought hard about four years ago at a previous company to upgrade us from PHP 5 to 8 because I think 5 was going EOL or something like that (could be wrong about that now). Based on my experience in software, I have to imagine the vast majority of normal developers do not give a damn about security in being in security patch lifecycles on software.
forgotaccount3 11 minutes ago [-]
> I have to imagine the vast majority of normal developers do not give a damn about security in being in security patch lifecycles on software.
I just don't think it's the developer's responsibility.
Depending on the size of the team of course, but the work that developer's do comes from someone else. Empower me to make decisions and I'll make them, but don't blame me for the choices other people make if you won't empower me.
13 minutes ago [-]
tosti 41 minutes ago [-]
PHP is going to publish the patch in 5 minutes, right? On their website which runs on... Perl Catalyst? Ruby on Rails? Django? What could possibly go wrong?
freshpaint 39 minutes ago [-]
It's scheduled to release at 14:00 UTC so around an hour from now.
p-e-w 14 minutes ago [-]
Why is this fix “scheduled” rather than ASAP?
Ambroos 2 minutes ago [-]
Because you need a certain amount of notice and in this case drama to be created so people know to update ASAP, before the exploit is out in the wild. As soon as these patches are out it becomes a lot easier for any actors to figure out exactly what they are patching, and how to exploit it.
Announcing when this patch is going to be released should leave a much shorter vulnerable window with the exploit out in the wild than releasing it immediately and hoping people update before they're a target.
worldsavior 5 minutes ago [-]
Who knows? Not any official explanation for this.
tosti 26 minutes ago [-]
Whoops, sorry, that's right. Thanks!
jayknight 18 minutes ago [-]
php.net does run php, but one would assume they are already on the patched version.
Well, the public website of the NCSC is offline. Who knows what crazy proprietary stuff they have.
jacquesm 28 minutes ago [-]
I don't know. Still, at a time like this I would expect a 99% static public website to be up, running and serving all comers. This is a complete mission fail, both in terms of using PHP and in terms of not having a fall-back plan in place.
piker 22 minutes ago [-]
Due respect, neither of those make sense. PHP is boring software, and this website routinely suggests (1) use it if it is fit for purpose and (2) don't rewrite for the sake of it. For most sites, the engineering effort to have a static backup of their dynamic website (say, generated by Wordpress or Drupal) just isn't possible. They just need to power down and patch.
[EDIT: I see I may have erroneously extended your criticism to sites other than NCSC, for which it does make sense. I would still defend using PHP.]
baaym 41 minutes ago [-]
Not all hacks are used to steal data. It's an authoritative website. If this hack is used to host a fake PHP fix stuffed with credential stealers then you have a problem.
WJW 33 minutes ago [-]
Oh I absolutely agree they should take it offline until the fix is ready, I just mean that the NCSC itself is very much still operational even if their public website is temporarily offline. Like a computer with the monitor switched off.
BlackRabbit1 42 minutes ago [-]
PHP 4 maybe? lol
gaiagraphia 2 minutes ago [-]
>The National Cyber Security Center (NCSC)
>Safely ahead in a digitally resilient Netherlands.
Things being offline seems like a daily occurrence recently. Is it a co-incidence? Is it AI? Are Russia/Iran doing an e-blitzkrieg?
If it's a combination of all three, surely nation states are going to unleash everything possible right now and do as much damage before the world adapts and becomes resilient?
If the latter, would be interesting to put an actual cost on all this downtime and whether it's actually making any impact, or is just noise/free training.
It's easy to harp on PHP but I wonder if we're going to get this kind of vulnerabilities in languages like Python or Go soon too.
Avamander 4 minutes ago [-]
PHP is worse in this aspect with its long tail of legacy and staying close to C. It's absolutely possible that memory-unsafe Python interpreters could have something vaguely similar, but much less likely. Plus there are Python interpreters in memory-safe languages.
In any case, memory-unsafe codebases will continue to be a significant danger. Be it in interpreters or anywhere else. Just like they have been for the past 20 years.
phplovesong 10 minutes ago [-]
Probably not. PHP is so badly built these kinds of things happen frequently.
I've seen a number of notifications on X and Bluesky of people taking their sites offline, though. Supposedly Cloudflare is providing all customers a WAF rule that will mitigate the exploits they've been able to see so far (though they mention, this is not full protection—patching is still required).
The only significant thing lost of comments, but they have been getting more spammy over the years. Its actually better now too in many ways and I fixed various issues during the move.
https://sequoia.pub/comments
Unfortunately my static HTML is pre-rendered by a PHP engine before being served.
Dark day for Drupal and Wordpress, heh
This is like a Health Ministry recommending leech therapy to its employees.
Anyway.
CCB is overtly a marketing organization, not an IT security one.
IIRC they don't even host their own website, The Chancellery of the Prime Minister does it for them.
I think, given the (supposed) seriousness of this issue, it’s an adequate response. I suspect Cloudflare et al will have rules added to their managed WAFs within a few hours after release as well.
That said: it seems like the core issue is that they can’t release PHP publicly without revealing the exploit, wouldn’t it have made more sense to coordinate in the background with these organizations, and important distros, so that this could have been patched without revealing the exploit?
But they say it's a stopgap and still advise patching. It makes sense, since their tweet also says "are updating mitigations as new vectors show up" so it seems like there are many ways to exploit this, whatever it is.
Europa.eu and all related subdomains were down very early CEST morning. They run Drupal.
> Today, a remote code execution vulnerability was found in PHP, called php2shell. [...] Since explain xkcd is affected by this exploit, I have decided to take the wiki down until tomorrow.
Once it's out it's likely to be an easy "disable this damnable feature nobody needs" as usual.
I just don't think it's the developer's responsibility.
Depending on the size of the team of course, but the work that developer's do comes from someone else. Empower me to make decisions and I'll make them, but don't blame me for the choices other people make if you won't empower me.
Announcing when this patch is going to be released should leave a much shorter vulnerable window with the exploit out in the wild than releasing it immediately and hoping people update before they're a target.
https://github.com/php/web-php
[EDIT: I see I may have erroneously extended your criticism to sites other than NCSC, for which it does make sense. I would still defend using PHP.]
>Safely ahead in a digitally resilient Netherlands.
Things being offline seems like a daily occurrence recently. Is it a co-incidence? Is it AI? Are Russia/Iran doing an e-blitzkrieg?
If it's a combination of all three, surely nation states are going to unleash everything possible right now and do as much damage before the world adapts and becomes resilient?
If the latter, would be interesting to put an actual cost on all this downtime and whether it's actually making any impact, or is just noise/free training.
https://yle.fi/a/74-20252600
In any case, memory-unsafe codebases will continue to be a significant danger. Be it in interpreters or anywhere else. Just like they have been for the past 20 years.